--- title: SIRP SOAR Add-On for Splunk description: SIRP SOAR Add-On for Splunk is the technical add-on (TA) developed by SIRP Labs. This add-on enables Splunk Enterprise users to push high-fidelity alerts and incidents from Splunk to SIRP SOAR, in real time. --- [Skip to content](https://content.sirp.io/knowledge-base/sirp-soar-add-on-for-splunk-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) # SIRP SOAR Add-On for Splunk ### Overview SIRP SOAR Add-On for Splunk is the technical add-on (TA) developed by SIRP Labs. This add-on enables Splunk Enterprise users to push high-fidelity alerts and incidents from Splunk to SIRP SOAR, in real time. ### Requirements - Splunk version 6.3 or later - This application should be installed on **Search Head**. ### Recommended System Configuration - Standard Splunk configuration of **Search Head**. ### Installation There are three ways to install SIRP Add-on for Splunk: 1. Install from Splunk web UI. - Go to **Manage Apps \> Browse more apps \> Search "SIRP"**.   [![](https://downloads.intercomcdn.com/i/o/673634150/c7e484c8e9ee100ee105029a/image.png?expires=1752237000&signature=8e1a6beec64047b43b87b3218cc26527f231cb2ee5757d9ecb08c6c8e25bdf18&req=cickEMp6nIRfFb4f3HP0gODcRxaYYwbssmM7drJAP79%2BM1qYwCTl6WS5UG4D%0A4n8%3D%0A)](https://downloads.intercomcdn.com/i/o/673634150/c7e484c8e9ee100ee105029a/image.png?expires=1752237000&signature=8e1a6beec64047b43b87b3218cc26527f231cb2ee5757d9ecb08c6c8e25bdf18&req=cickEMp6nIRfFb4f3HP0gODcRxaYYwbssmM7drJAP79%2BM1qYwCTl6WS5UG4D%0A4n8%3D%0A) [![](https://downloads.intercomcdn.com/i/o/673635774/2854c880ce028f33c2f2e905/image.png?expires=1752237000&signature=bc3c99dfa18aeae2e798218d3bc1b39cb43c7b4a23603c013b2138ebc789bdd9&req=cickEMp7moZbFb4f3HP0gIF8f3Fa1CmOFgOoZK9ztsYtl4XGb3fh1Dlkptsu%0ATDQ%3D%0A)](https://downloads.intercomcdn.com/i/o/673635774/2854c880ce028f33c2f2e905/image.png?expires=1752237000&signature=bc3c99dfa18aeae2e798218d3bc1b39cb43c7b4a23603c013b2138ebc789bdd9&req=cickEMp7moZbFb4f3HP0gIF8f3Fa1CmOFgOoZK9ztsYtl4XGb3fh1Dlkptsu%0ATDQ%3D%0A) - Locate the **SIRP** app then Click the "**install**" button to initiate the installation. - Once the process is completed, restart Splunk Service from **Settings \> Server Controls \>** Click **"Restart Splunk"** to finish the installation.   [![](https://downloads.intercomcdn.com/i/o/673641981/e652ba2be91fd33816d7b1aa/image.png?expires=1752237000&signature=489cf2dd582f70a76f9065d577a28097fbdc316bd03aaa3a8e5876ecdb44f3a0&req=cickEM1%2FlIleFb4f3HP0gAigKXRuGSEQnLTJ8ZNRjbRIkYVponm8sfQ9FcGj%0Aig0%3D%0A)](https://downloads.intercomcdn.com/i/o/673641981/e652ba2be91fd33816d7b1aa/image.png?expires=1752237000&signature=489cf2dd582f70a76f9065d577a28097fbdc316bd03aaa3a8e5876ecdb44f3a0&req=cickEM1%2FlIleFb4f3HP0gAigKXRuGSEQnLTJ8ZNRjbRIkYVponm8sfQ9FcGj%0Aig0%3D%0A) 2. Download the Add-on file from **[https://splunkbase.splunk.com/apps](https://splunkbase.splunk.com/apps)** and install it from Splunk web UI. - Go to **Manage Apps** **\>** Click **Install the app from file** \> Locate and **Upload** the downloaded .spl file (Check the upgrade box).   [![](https://downloads.intercomcdn.com/i/o/673644100/7335fe2470cf1e969d110e09/image.png?expires=1752237000&signature=8f464aff95832cffa7b542911c7f4418cdcca3093c7e67ed5a6f654ed3c9eb5a&req=cickEM16nIFfFb4f3HP0gGNyc0MpzS%2FBILbV54NtvPTakNmITmLpAoNLvr6H%0A8yM%3D%0A)](https://downloads.intercomcdn.com/i/o/673644100/7335fe2470cf1e969d110e09/image.png?expires=1752237000&signature=8f464aff95832cffa7b542911c7f4418cdcca3093c7e67ed5a6f654ed3c9eb5a&req=cickEM16nIFfFb4f3HP0gGNyc0MpzS%2FBILbV54NtvPTakNmITmLpAoNLvr6H%0A8yM%3D%0A) - Once the process is completed restart Splunk Service from **Settings \> Server Controls \>** Click **"Restart Splunk"** to finish the installation.   [![](https://downloads.intercomcdn.com/i/o/673641981/e652ba2be91fd33816d7b1aa/image.png?expires=1752237000&signature=489cf2dd582f70a76f9065d577a28097fbdc316bd03aaa3a8e5876ecdb44f3a0&req=cickEM1%2FlIleFb4f3HP0gAigKXRuGSEQnLTJ8ZNRjbRIkYVponm8sfQ9FcGj%0Aig0%3D%0A)](https://downloads.intercomcdn.com/i/o/673641981/e652ba2be91fd33816d7b1aa/image.png?expires=1752237000&signature=489cf2dd582f70a76f9065d577a28097fbdc316bd03aaa3a8e5876ecdb44f3a0&req=cickEM1%2FlIleFb4f3HP0gAigKXRuGSEQnLTJ8ZNRjbRIkYVponm8sfQ9FcGj%0Aig0%3D%0A) 3. Download the Add-on file from **[https://splunkbase.splunk.com/apps](https://splunkbase.splunk.com/apps)** and install it from the Splunk console. 1. Download the file on your Splunk server and extract the .spl file into the $SPLUNK\_HOME/etc/apps/ folder. ``` $tar zxvf splunk-addon-for-SIRP.tgz $SPLUNK_HOME/etc/apps/ ``` 2. Restart Splunk Service ``` $/opt/splunk/bin/splunk restart ``` #### New Custom Alert Action Once installed, this add-on will add a new custom alert action named "Push Alerts to SIRP". #### Custom Alert Action Configuration Configuration of the action can be performed at the time of creating and saving a new search. #### How to Use Custom Alert Action: - Click **Search and Reporting** from the top menu. [![](https://downloads.intercomcdn.com/i/o/673686158/551030b8fc374403d32860b1/image.png?expires=1752237000&signature=f0fef02d0bd070032f3d92965c3fc101cd92d5bc4b0a981db4def780fcd1c839&req=cickEMF4nIRXFb4f3HP0gFgXtgytkmRLGdvXO6cVb4J%2FrBHXxQghtUJkca30%0Apfw%3D%0A)](https://downloads.intercomcdn.com/i/o/673686158/551030b8fc374403d32860b1/image.png?expires=1752237000&signature=f0fef02d0bd070032f3d92965c3fc101cd92d5bc4b0a981db4def780fcd1c839&req=cickEMF4nIRXFb4f3HP0gFgXtgytkmRLGdvXO6cVb4J%2FrBHXxQghtUJkca30%0Apfw%3D%0A) - Create/write a new search query and press Enter. Once satisfied with the results, save your search as an alert by clicking on the "**Save As**" button. [![](https://downloads.intercomcdn.com/i/o/673687017/3e0b371ea82fd9654963f23e/image.png?expires=1752237000&signature=b41b5ac3a9fec023200f8af3a5c3f0af4874747dd709259828676f4bb6bb4930&req=cickEMF5nYBYFb4f3HP0gAzjg3qthxQsnw4Llym0aytrjZptgt1CR%2BnxRBV%2F%0A1M4%3D%0A)](https://downloads.intercomcdn.com/i/o/673687017/3e0b371ea82fd9654963f23e/image.png?expires=1752237000&signature=b41b5ac3a9fec023200f8af3a5c3f0af4874747dd709259828676f4bb6bb4930&req=cickEMF5nYBYFb4f3HP0gAzjg3qthxQsnw4Llym0aytrjZptgt1CR%2BnxRBV%2F%0A1M4%3D%0A) - In the configuration of the new Alert, click "Add Actions" and choose "Push Alerts to SIRP" from the dropdown. [![](https://downloads.intercomcdn.com/i/o/673687605/16250b27a42967e5a3f2dbf7/image.png?expires=1752237000&signature=0489a913b824b63593f2d14a7eaf987c95d8f4ed424539b0cecf8c7ab6b7fd41&req=cickEMF5m4FaFb4f3HP0gFrYPmOxxPhcppPUXleYcIbtfgCAIdKiK0qoZn82%0Aro4%3D%0A)](https://downloads.intercomcdn.com/i/o/673687605/16250b27a42967e5a3f2dbf7/image.png?expires=1752237000&signature=0489a913b824b63593f2d14a7eaf987c95d8f4ed424539b0cecf8c7ab6b7fd41&req=cickEMF5m4FaFb4f3HP0gFrYPmOxxPhcppPUXleYcIbtfgCAIdKiK0qoZn82%0Aro4%3D%0A) Configure the Incident details to define the field mapping between SIRP and Splunk: - SIRP's API Key - SIRP's instance URL - Subject/Title of the Alert - Priority - Severity - Payload – a comma-separated "key":"value" pairs of custom fields. e.g, {"Subject":$event.Title$, "Category":$event.Category$} - Artifacts – a comma-separated "key":"value" pairs of artifacts/IOCs e.g. {"Destination IP":$event.Message$,"Source IP": $event.Message$} [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-58-23-1930-AM.png)](https://downloads.intercomcdn.com/i/o/673688702/56976da4382a747b7dd6faac/image.png?expires=1752237000&signature=46c951be76f5c7503a2144d2c2a0782d95a77484f1515fa90e7401ec043faca7&req=cickEMF2moFdFb4f3HP0gOm9ngIPf%2FM0SwbUaegV3kwVFRLYGnoD2EW8eyX4%0ABhqGQmEzMIEfCs2Bkw%3D%3D%0A) Note: $event.field-name$ is a format to define Splunk fields in the "value" against the SIRP fields which are defined as "key". Once configured successfully, new alerts from Splunk will be pushed to and visible in SIRP's Incident Management module. - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc